ITSM & network observability platform: Assets, tickets and traffic in one console
A self-hosted IT operations platform that replaced spreadsheets, log viewers and scattered admin consoles for an internal IT department: near a thousand devices tracked, network logs and NetFlow analyzed on ClickHouse with statistical anomaly alerts, ITIL ticketing in enterprise chat. It shipped across 127 released versions with 207 automated tests.
Updated
In production · anonymised demo
Built and operated in production for a company that is deliberately not named. The demo you can open is the same system, sanitised: real data and names removed, everything else as deployed.
Account rotation
5 days left
- System
- FortiGate firewall
- Account
- fwadmin
Due for rotationSample data
The starting point
The IT team ran the office network on a patchwork: asset lists in spreadsheets, passwords in a shared document, firewall logs viewable only on the box, no NetFlow visibility, and tickets arriving by chat message and getting lost. Nothing connected an IP address to a device to its owner.
What was built
- Asset ledger, encrypted credential vault (AES-256-GCM) and software-subscription tracking in one place
- Syslog, SNMP and NetFlow collectors feeding ClickHouse, with statistical anomaly alerts for deny spikes, port scans and lateral movement
- Endpoint attribution engine: any IP or MAC resolves to a physical device and its owner, despite MAC randomization
- ITIL ticketing with a legal state machine, opened and updated straight from enterprise chat
- Live network topology, IPAM and wireless monitoring across switches, APs and firewalls
- Zero-downtime deployments; 127 released versions and 207 automated tests over the platform’s life
Tech stack
- React
- TypeScript
- FastAPI
- ClickHouse
- PostgreSQL
- Docker
What it changed
- "Whose device is this IP?" went from an afternoon of detective work to one search
- Security-relevant traffic patterns surface as alerts instead of being discovered after the fact
- Tickets stopped getting lost in chat; every request has a number, an owner and a state
- Credentials moved out of shared documents into an encrypted, role-scoped vault with audit logs
Common questions
Is this SaaS? Where does our network data live?
No, it is self-hosted on your own server (Docker Compose). Logs, credentials and asset data never leave your infrastructure, which for network-security data is usually a hard requirement.
Our switches and firewalls are a mixed bag of brands. Will it work?
The collectors speak standard protocols (syslog, SNMP and NetFlow v9), which nearly every network vendor supports, and per-vendor API integrations (the delivered system integrates a major firewall and wireless-controller brand) are added as needed.
Can we start with just ticketing or just monitoring?
Yes. The platform grew module by module across 127 releases, and a new deployment is scoped the same way: start with the module that hurts most, add the rest as phased milestones.